FYI: Trend CSM 3.5, Small Business Server 2003 and the .notaccount user account

I installed Trend CSM 3.5 on my SBS2003 server at the office a little while ago.  A few days later I noted security alerts in my Server Performance Reports that merited further investigation.

The errors are the classic "unknown user name or bad password" which is not unusual in and of itself - all of us who look after servers see such errors quite regularly when the bad guys try to guess usernames and passwords in an attempt to get into our servers.  What is unusual is that the username is strange, and the errors are occurring every day.

A little investigation reveals that the errors are being caused by Trend CSM 3.5.  Messy Trend, very messy - I don't like my security logs being filled with aberrant 529 alerts.

I conducted a quick search of Trend's online knowledgebase for ".notaccount", and "error 529" and "529" with zero results, so I don't have a fix yet Sad

Screenshot of error:

Published Sat, Feb 17 2007 21:29 by sandi
Filed under:

Comments

# re: FYI: Trend CSM 3.5, Small Business Server 2003 and the .notaccount user account

Monday, February 19, 2007 2:15 AM by Anders

Thanks for posting this. We have the same problem in our servers. You are not alone.

# re: FYI: Trend CSM 3.5, Small Business Server 2003 and the .notaccount user account

Thursday, March 01, 2007 2:11 PM by Keith

Yes thanks for posting. I seeing this on one of our servers as well SBS2003 with new CSM 3.5

# re: FYI: Trend CSM 3.5, Small Business Server 2003 and the .notaccount user account

Sunday, March 04, 2007 7:03 AM by Mike

Looks like a general issue with Trend CSM 3.5

Thanks for posting this ... some (little) comfort in knowing that I am not alone with this problem.

# re: FYI: Trend CSM 3.5, Small Business Server 2003 and the .notaccount user account

Saturday, March 10, 2007 4:47 PM by Lee

Yeah - same problem here. I will poke one of my contacts at Trend to see if there is anything known / planned in relation.

# re: FYI: Trend CSM 3.5, Small Business Server 2003 and the .notaccount user account

Saturday, March 10, 2007 10:35 PM by sandi

Thanks Lee. I'll be interested to heaar what the outcome of your enquiries is; I still don't know why it's happening. It's an irritating bug to put up with - makes a mess of my logs :)

# The Trend Notaccount

Wednesday, March 21, 2007 1:51 AM by E-Bitz - SBS MVP the Official Blog of the SBS "Diva"

Sandi blogged about this earlier -- http://msmvps.com/blogs/spywaresucks/archive/2007/02/17/588924.aspx

# Trend CSM and .notaccount. errors in server security logs - 529 and 681

Wednesday, March 21, 2007 6:06 AM by Spyware Sucks

I first blogged about this back in February when I spotted the issue on my networks, but back then I

# re: FYI: Trend CSM 3.5, Small Business Server 2003 and the .notaccount user account

Tuesday, April 03, 2007 11:25 PM by sandi

There is apparently an updated version of mdHOConsole.dll that fixes the error described. Will post when I have received the fix and tested.